Glossary / Infrastructure as code
What is IaC review?
Infrastructure-as-code (IaC) review examines the configuration that describes infrastructure before a change is deployed. Reviewers inspect resources, dependencies and policy assumptions, then record issues and questions requiring further evidence. Static review can inform a deployment decision, but it cannot by itself establish runtime behavior.
Illustrative fragment
A setting starts a question.
This is a single property, not a complete deployment template.
{
"publicNetworkAccess": "Enabled"
}Is public access intended?
Check the resource type, service defaults, network rules and authentication before deciding whether this configuration is acceptable.
The fragment is an educational example, not an observed vulnerability.
What static review does not prove
A source file describes intended configuration. It does not establish that a deployment succeeded, that the environment matches the source, or that traffic and permissions behave as expected.
- Use deployment validation and live evidence for those separate questions.
- Record unresolved assumptions instead of presenting them as passing checks.
